Subject: SMTP Minimum Retry Period - Proposal To Modify Mx

From: "Sabahattin Gucukoglu" <[email-masked]>
Date: Fri, 09 Jan 2004 16:28:13 -0000

Hi people,

I have a friend whose on ADSL and who wants to run his own email service, 
but is periodically disconnected.  He likes his mail delivered straight to 
his primary host, but his mate is there across the other side of the 
country if ever he's out as a backup MX.  Now, every time he uses the 
connection, which is at least once every few hours and at most once a day, 
his connection automagically reestablishes itself.  While he's been down, 
though, any mail destined for him has gone to his mate, who only delivers 
mail once every four hours or so.  By misfortune, my friend has gone down 
just as a mail was being queued for sending, in a place far away.  Being 
down, he can't take the mail, so his mate takes it for him.  He must wait 
four whole hours, assuming he has come up after the delivery of that 
message to his mate, even if the originating client was willing to deliver 
it sooner - say, thirty minutes, if his mate hadn't been around.  There's 
just one more condition - his mate, though great as mates go, is an anti-
RBL purist.  He refuses to use RBLs.  His mate is picking up spam which he 
would have rejected, had he been responsible, and it isn't reasonable to 
parse the mail after the mail is accepted, in particular because he's 
serving other people and doesn't justify this kind of intrusive filtering.

Now, all that was mostly hypothetical - based on a true story.  If my 
friend is some poor soul on ADSL, and his mate (that is, friend, just in 
case - buddy for the Americans) is a dynamic service provider with backup 
MX facilities or some organisation who can't reasonably be expected to 
alter their mail service policies to be in line with that of my friends 
who are of my anti-spam, direct-to-destination kind with no wish to be at 
the mercy of our ISPs, we need some mechanism to tell the SMTP client to 
keep trying to deliver to a particular MX(es), for a particular time(s).

My proposal: an extension to the MX record in the DNS, which must be 
backward compatible with existing MX records - that is, non-conformant 
mailers must not be confused by the new form of the record.  The creation 
of a new record type must only be necessary if that record type may 
facilitate many such extensions, not just this one.  This use of the MX 
might look like:
example.org: mx 10 example.org 86400
(Or, if the record - new or existing - is used extensibly, something like 
"mx 10 example.org MRP86400")
Where 86400 is the minimum number of seconds (1 day) for which the MX must 
be tried before those of lower priority must be tried.  If other MX 
records exist with same preference, then the same rule applies to those 
hosts, except that the delivery timeouts occur in parallel, and no MXs of 
lower preferences are to be tried until all MXs at this preference have 
been tried - that is, if:
mx 10 mx1.example.org 60
mx 10 mx2.example.org 30
mx 20 mx3.example.org
Then mx1.example.org and mx2.example.org will be tried simultaneously 
(that is, one after another but immediately following as in normal MX 
selection and delivery attempt behaviour), with the client giving delivery 
attempts whenever it usually does at whatever intervals it normally uses 
until the timeout occurs on mx2, at which point only mx1 is continually 
assaulted with the same algorithms as before, until it to is deemed 
unusable - 30 seconds later (hypothetical numbers, we'd normally be 
talking many hours!).  Only at this point is mx3 tried, which may or may 
not have such a minimum time given, and the same algorithm procedure is 
used at this preference.  As you see here the mx3 is listed without the 
MRP, which may be away of avoiding compatibility issues.

Where local policy dictates differing delivery times and intervals, the 
time given in the DNS must always be respected - so, if you deliver first 
at 30 minutes, then at 60 following, then 2 hours, then 4 etc. in a 
typical backoff style, then the sum of these times preceding must be 
waited against the value in DNS (in seconds).  If the total time spent 
attempting delivery to this host is now exceeded, then - at discretion of 
administrator - the unreachable host may be tried once more.  In any 
event, it is now permissible to proceed to lower-priority MXs.

Since this is meant to be backwards-compatible, there's a possible 
argument that mandating the attempts for the MRP for compliant systems is 
a bit counter-intuitive; I'm hoping that enough systems could do this to 
make it worthwhile, and there's no other way of achieving the same thing 
without an MX knowing when another MX of higher preference was both 
available and not available (the latter obviously being very hard to 
advertise, because it aint available!) with which knowledge the MX could 
either accept the mail or refuse to accept mail on the grounds that the 
higher MX was already available.

Of course, this little flash of brilliance ( :-P ) is only going to work 
if we can bend the DNS without anyone noticing.  Which, chances are, they 
will.  RFC 2821 which replaced RFC 974 before it on this matter makes no 
reference to the exact way in which MX records should be parsed, so that 
it could be chancy.

Still, what do you all think?

Cheers,
Sabahattin
- -- 
Thought for the day:
    Bagpipes (n): an octopus wearing a kilt.

Latest PGP Public key blocks?  Send any mail to:
<[email-masked]>

Sabahattin Gucukoglu
Phone: +44 (0)20 7,502-1615
Mobile: +44 (0)7986 053399
http://www.sabahattin-gucukoglu.com/
Email/MSN: <[email-masked]>

---

From: Keith Moore <[email-masked]>
Date: Fri, 9 Jan 2004 12:03:07 -0500

> There's 
> RBL purist.  He refuses to use RBLs.

His mate is a wise man.  RBLs are a really terrible idea, and they've
caused a lot of valid mail to be rejected.  There's really no way to
reliably determine that a message is spam based on the IP address or
sender's domain name.  The most you should do with RBLs is delay or
rate-limit mail from the blacklisted sites, you should never reject
such mail.

> mailers must not be confused by the new form of the record.

Doesn't seem like a good idea in general, nor does it seem necessary. 
It's perfectly reasonable for the secondary MX to be explicitly 
configured to flush its mail queue for the primary MX at pre-determined
times (as in a cron job).  It's also perfectly reasonable for the
primary MX to contact the secondary MX at regular intervals and
(using any of a variety of mechanisms) say "please give me my mail".

So it doesn't seem like we need a new DNS RR to solve this problem.

Keith

---

From: Vernon Schryver <[email-masked]>
Date: Fri, 9 Jan 2004 10:56:04 -0700 (MST)

> From: Keith Moore <[email-masked]>

> ...
> ..

It's never clear to me what Keith Moore means by "RBL" when he repeats
that claim.  Those three letters are a registered service mark for a
product that historically has been run so conservatively that claims
that should not be used to reject mail sound silly.  You would certainly
want to do more than just rate limit Cyberpromo's spam.

He might be referring to other DNS (or BGP) distributed, more or less
real time blacklists.  Depending on which of the zillions of lists he
is talking about, his claim is either entirely accurate or even worse
than it would be if it refers to MAPS's RBL(sm).  Some DNS blacklists
are at best used for scoring and only by those who don't mind affecting
legitimate email.  Other DNS blacklists have false positive rates
(legitimate rejected/total legitimate) below 0.01% that allow them to
be used by corporations that would rather receive 1000 spam than reject
one legitimate message.

If his claim refers to private blacklists, then it is obvious nonsense.
There are many IP addresses (e.g. WholesaleBandwidth's /18) that will
never send mail that anyone but a spammer wants delivered for the
foreseeable future.  Then there are private blacklists of domain names
that are undeniably valid targets of complete blacklisting, starting
with Cyberpromo.com.

The clear and undesputed (except by spammers and some others with
special interests) consensus is that blacklists are undesirable but
entirely legitimate, useful, and often necessary mechanisms for dealing
with network abuse by rejecting, not just delaying mail.  The buyer
(or user) must beware, but Keith Moore blanket condemnation of "RBLs"
is simply wrong.  His apparent claim that SMTP servers must accept
mail from everywhere as much sense as claims R. Stallman's complaints
20 years ago closed telnet ports.

Note none of the SMTP servers I run use any DNS (or BGP) SMTP
blacklists.  He's not trying to gore any of my oxen.

Vernon Schryver    [email-masked]

---

From: [email-masked] (Mike S)
Date: Fri, 09 Jan 2004 15:13:50 -0500

At 12:03 PM 1/9/2004, Keith Moore wrote...
>caused a lot of valid mail to be rejected. 

Not only that, but at least in the U.S., they are illegal per 18 U.S.C. 1030 -Fraud and Related Activity in Connection with Computers. That law reads in part:

"Whoever... knowingly causes the transmission of a program, information, code, or command, and as a result of such conduct, intentionally causes damage without authorization, to a protected computer...shall be punished..."

MAPS RBL and DUL and those who participate in it knowingly transmit information (zone lookups) and commands (SMTP configurations) which causes unauthorized damage to protected systems. 

"[T]he term "protected computer" means a computer... which is used in interstate or foreign commerce or communications, including a computer located outside the United States that is used in a manner that affects interstate or foreign commerce or communication of the United States"

This clearly covers any computer with which the user may send email for Internet commerce, including eBay and web purchases.

"The term 'damage' means any impairment to the integrity or availability of data, a program, a system, or information"

Use of the MAPS RBL and DUL clearly impairs the availability and integrity of the Internet email system and the information transferred using that system. MAPS RBL and DUL participants are actively participating in illegal denial of service

---

From: Keith Moore <[email-masked]>
Date: Fri, 9 Jan 2004 16:25:46 -0500

> > His mate is a wise man.  RBLs are a really terrible idea, and
> > they've caused a lot of valid mail to be rejected.  There's really
> > no way to reliably determine that a message is spam based on the IP
> > address or sender's domain name.  The most you should do with RBLs
> > is delay or rate-limit mail from the blacklisted sites, you should
> > never reject such mail.
> > ..
> 
> that should not be used to reject mail sound silly. 

Yes, "RBL" did indeed reject valid mail, because it misled site
administrators into thinking that mailers that failed its test were
inherently able to be exploited into relaying significant amounts of
spam.  So sites that trusted RBL's misrepresentation blocked valid mail
from sites that rate-limited relayed mail (including the site I ran at
one time) even when that rate-limiting was an effective spam block. 

I really have no sympathy for net vigilanties who insist on trying to
enforce their own narrow-minded definitions for how the net should work,
and who disrupt others' service in the process.

---

From: [email-masked]
Date: Fri, 09 Jan 2004 17:42:04 -0500

On Fri, 09 Jan 2004 15:13:50 EST, [email-masked] (Mike S)  said:

> Use of the MAPS RBL and DUL clearly impairs the availability and integrity of
> the Internet email system and the information transferred using that system.
> MAPS RBL and DUL participants are actively participating in illegal denial of
> service

Erm.  No.

Note that MAPS is *NOT* blocking a single piece of e-mail itself.  None. Zip. Zero.

All they are doing is publishing information regarding their opinion of a given host's
mail policies.  As such, they're not interfering with anything, but merely answering
queries.

Meanwhile, the site that's actually rejecting your mail has made that decision *itself*,
that it doesn't want to receive mail from you, possibly with MAPS as one component
of the information used to make said decision.

To have a chance of winning this argument, you'll have to prove that the receiving
system is legally *obligated* to accept every piece of mail that you might happen to
want to send.

---

From: [email-masked] (Mike S)
Date: Fri, 09 Jan 2004 18:00:54 -0500

At 05:42 PM 1/9/2004, [email-masked] wrote...
>Erm. 

Sounds like you're choking on something.

> No.

You are.

>Note that MAPS is *NOT* blocking a single piece of e-mail itself.  None. Zip. Zero.

Of course not. MAPS is simply a database. As I quite clearly said, *USE* of MAPS impairs email.

>system is legally *obligated* to accept every piece of mail that you might happen to

MX <> recipient. If I send email [email-masked] to the published MX for aol.com and aol.com blocks the ultimate recipient from receiving that email, they are in violation of the law, having interfered with the availability of email for both the sending and receiving systems. By publishing an MX, they have agreed to accept email for any valid address within their domain. That's what an MX is. They are likely in breach of their civil contract with the recipient, also.

Of course, anyone who publishes an MX record but refuses mail is simply an idiot incapable of understanding why the Internet exists in the first place. The Balkanization has begun. The Internet is dead.

---

From: Vernon Schryver <[email-masked]>
Date: Fri, 9 Jan 2004 16:41:10 -0700 (MST)

> Yes, "RBL" did indeed reject valid mail,

I never heard of any examples of mail considered valid by its targets
that was rejected as the result of RBL listings.  There was plenty of
screaming and whining by advertisers would be about their supposed
free speech rights.

Could you point to significant amounts of real mail, as opposed to
theoretical examples, that might reasonably have consider legitimate
by its targets but that was rejected as the result of a MAPS RBL
listing?  Note that the validity of mail is determined not its senders
but by its targets.

>                                          because it misled site

That makes no sense to me.  It sounds like a confounding of other
blacklists with MAPS's RBL.  The RBL is (was?) based on spam received
instead of open relays inferred by probing.  Or perhaps it is a statement
that you were "misled ... into thinking" that some "mailer" failed
some test.  Or is it at statement that bulk mail you sent was rejected
by its targets?

In any case, what standing do you have to comment on what mail is
rejected by other peoples SMTP servers?  I think that as long as
those using blacklists get what they ask for, no outsiders have any
business commenting, and particularly not would be senders of
unsolicited bulk mail.

> and who disrupt others' service in the process.  

Do you have any idea how ironic that statement is?  Can you imagine
that the saying "their network; their rules" might apply to all of us?
I happen to agree with some of your statements about NAT, but I hope
I'm sane enough to not act on them, because "trying to enforce [that]
narrow-minded [definition] for how the net should work [would] disrupt
others' service in the process."

By the way, do you also agree with the other individual who repeated
the familiar (in spammy circles) kooky wishful thinking that running
a DNS blacklist somehow violates U.S. Federal law?

---

From: [email-masked]
Date: Fri, 09 Jan 2004 17:31:45 -0500

> product that historically has been run so conservatively that claims

Unfortunately, this has probably gone the same way as Linoleum.

> foreseeable future.

Yeah, and 69/8 wouldn't be sending packets for the forseeable future either.

Look where it got the people who got the early allocations out of that range.

---

From: Ken Raeburn <[email-masked]>
Date: Fri, 9 Jan 2004 18:43:55 -0500

On Friday, Jan 9, 2004, at 18:00 US/Eastern, Mike S wrote:
> MX <> recipient. If I send email [email-masked] to the published MX 
> for aol.com and aol.com blocks the ultimate recipient from receiving 
> that email, they are in violation of the law, having interfered with 
> the availability of email for both the sending and receiving systems. 
> By publishing an MX, they have agreed to accept email for any valid 
> address within their domain. That's what an MX is. They are likely in 
> breach of their civil contract with the recipient, also.

So, by that argument, an MX site for FooISP (which presumably would be 
run by FooISP, or at least under contract with FooISP) can't use 
Spamassassin or Greylisting to avoid spam either, nor any other 
criteria.  The spammers must love you.

An ISP using such tools may be in breach of contract with the 
recipient; it depends on the contract, of course.  More likely, I 
suspect, the contract gives them the latitude to prevent abusive 
behavior, or rejects any guarantees of availability of services at any 
given time or when dealing with non-local resources.  Which is probably 
enough to cover Spamassassin and RBL.

If you think there's some violation of law going on here, please be 
more specific.  What law, and in what country?  As Valdis said, you 
need to show why they're obligated to accept absolutely every message, 
regardless of contracts.

> Of course, anyone who publishes an MX record but refuses mail is 
> simply an idiot incapable of understanding why the Internet exists in 
> the first place. The Balkanization has begun. The Internet is dead.

Um, right.  Maybe my troll filter is on the blink today?

Ken

---

From: grenville armitage <[email-masked]>
Date: Sat, 10 Jan 2004 11:14:36 +1100

Mike S wrote:
	[..]
> "Whoever... knowingly causes the transmission of a program, information, code, or
> command, and as a result of such conduct, intentionally causes damage without
> authorization, to a protected computer...shall be punished..."

Your email is not authorized to enter and reside on a recipient's mail server until and
unless the recipient's mail server says it is. Mail servers are entitled to refuse reception
of your email using whatever decision process they choose. This includes the method of
assigning a "this source is likely a spammer" semantic to responses received from lookups
on certain externally maintained lists.

cheers,
gja
-- 
Grenville Armitage
http://caia.swin.edu.au
I come from a LAN downunder.

---

From: Franck Martin <[email-masked]>
Date: 10 Jan 2004 13:02:32 +1200

> Of course, anyone who publishes an MX record but refuses mail is simply an idiot incapable of understanding why the Internet exists in the first place. The Balkanization has begun. The Internet is…

Any user of such services agree to a user agreement of use of the
service, which includes the right for the service to filter e-mail,
monitor content, and terminate the user account.

It is interesting to see that with the new US law, some people are
trying to find justification within the IETF on why SPAM should be
authorised. I would not be surprised if a few IETF members here be
summoned to one of these new multi-million dollar case base on their
comments...

Cheers

----
Franck Martin
[email-masked]
SOPAC, Fiji
GPG Key fingerprint = 44A4 8AE4 392A 3B92 FDF9  D9C6 BE79 9E60 81D9 1320
"Toute connaissance est une reponse a une question" G.Bachelard

---

From: Bill Sommerfeld <[email-masked]>
Date: Fri, 09 Jan 2004 20:33:40 -0500

> That law reads in part:
> 
> "Whoever... knowingly causes the transmission of a program,
> information, code, or command, and as a result of such conduct,
> intentionally causes damage without authorization, to a protected
> computer...shall be punished..."

Except that use of DNSBL's is generally authorized by the entity
administering the mail servers; moreover, it is increasingly clear
that the vast majority of email users do not regard the blocking of
spam as "damage".

See also 47 USC 230(c)(2):

   No provider or user of an interactive computer service shall be held
   liable on account of -

   (A) any action voluntarily taken in good faith to restrict access to
   or availability of material that the provider or user considers to be
   obscene, lewd, lascivious, filthy, excessively violent, harassing, or
   otherwise objectionable, whether or not such material is
   constitutionally protected; or

   (B) any action taken to enable or make available to information content
   providers or others the technical means to restrict access to
   material ...

---
As far as I'm concerned, spam is "otherwise objectionable".

And I believe that there is at least one congressional resolution
encouraging the private sector to work on spam control technologies..

						- Bill

---

From: [email-masked] (Mike S)
Date: Fri, 09 Jan 2004 22:06:56 -0500

At 06:43 PM 1/9/2004, Ken Raeburn wrote...
> If you think there's some violation of law going on here, please be more 
> specific.  What law, and in what country? 

Try to keep up. A specific citation has already been made.

---

From: Ken Raeburn <[email-masked]>
Date: Fri, 9 Jan 2004 22:32:10 -0500

On Friday, Jan 9, 2004, at 22:06 US/Eastern, Mike S wrote:
>> more

Not in any mail I've seen so far, but the other traffic since implies 
I've missed something.  Investigating that... my apologies.

In any case, the quotations I've seen suggest you believe that the 
blocking is done without authorization.  As I said in my previous mail, 
I suspect the service agreement is likely to provide for it; it would 
be something for the customer to take up with the ISP if they believe 
otherwise.  And I suspect the receiving computer to which "damage" 
would be done would be the ISP's mail server; presumably none of this 
is interfering with the transmission between the ISP's mail server and 
the customer's machine.

Ken

---

From: Bill Sommerfeld <[email-masked]>
Date: Sat, 10 Jan 2004 08:42:43 -0500

> Try to keep up. A specific citation has already been made.

and already been debunked.  

							- Bill

---

From: [email-masked] (Mike S)
Date: Sat, 10 Jan 2004 11:27:53 -0500

At 08:42 AM 1/10/2004, Bill Sommerfeld wrote...
>and already been debunked.  

If one considers spraying bullets and so shooting and killing innocent bystanders while defending against an assailant as legal, then yes, it's been debunked.

---

From: [email-masked] (Mike S)
Date: Sat, 10 Jan 2004 11:44:30 -0500

At 10:32 PM 1/9/2004, Ken Raeburn wrote...

>Not in any mail I've seen so far, but the other traffic since implies I've missed something.  Investigating that... my apologies.

18 U.S.C. 1030

>In any case, the quotations I've seen suggest you believe that the blocking is done without authorization. 

That is correct. Understand that I am NOT referring to UCE/spam. In the case of UCE/Spam, I will stipulate that the intended recipient may indeed have authorized upstream blocking/filtering. It is, however, irrational and incorrect to argue that the recipient has authorized blocking/filtering of email replies sent in direct response to queries they have sent. RBL/DUL makes no distinction between these types of email, and indiscriminately causes both types to be blocked. One cannot argue that general "best effort" or "no guarantees" terms of service cover this situation, since the blocking is known and deliberate.

> As I said in my previous mail, I suspect the service agreement is likely to provide for it;

I can only speak for the ISP agreements I've been a party to, and they do NOT authorize any upstream filtering or blocking.

>And I suspect the receiving computer to which "damage" would be done would be the ISP's mail server; presumably none of this is interfering with the transmission between the ISP's mail server and the customer's machine.

It is interfering with communications between sender and recipient, which is exactly what the cited law prohibits. The maintainer of the MX has publicly agreed to accept mail destined for the domain (by publishing an MX record). Blocking/refusing/filtering email bound for a protected system is a violation of U.S. law, unless specific authorization has been granted to do so, which has not occurred (see above).

---

From: Richard Welty <[email-masked]>
Date: Sat, 10 Jan 2004 12:08:20 -0500 (EST)

> If one considers spraying bullets and so shooting and killing
> innocent bystanders while defending against an assailant as
> legal, then yes, it's been debunked.

might i suggest citing some case law demonstrating the relevance
of the statute you cited?[1]  the rhetoric of your response is
largely content free. w/o supporting case law, your "legal
opinion" is of rather limited value. 

richard

[1] i, for one, will be extremely impressed if you actually dredge
some up. i don't think that statute has any relevance to dns based
BLs, whether a MAPS product or otherwise. the question is one
for the courts to decide, and i'm not at all aware of anyone
actually attempting to use that statute in the manner you suggest.
-- 
Richard Welty                                         [email-masked]
Averill Park Networking                                         518-573-7592
    Java, PHP, PostgreSQL, Unix, Linux, IP Network Engineering, Security

---

From: [email-masked] (Mike S)
Date: Sat, 10 Jan 2004 12:48:39 -0500

At 12:08 PM 1/10/2004, Richard Welty wrote...
>of the statute you cited?

Non sequitor. By your implied logic, no new laws could be effectively created or enforced, since all would lack precedent. The relevant code is relatively new, so only limited, if any, case law can be expected to be extant in any case.

---

From: [email-masked]
Date: Sat, 10 Jan 2004 13:55:49 -0500

On Sat, 10 Jan 2004 12:48:39 EST, [email-masked] (Mike S)  said:

> The relevant code is relatively new, so only limited, if any, case law can be expected to be extant in any case.> 

http://www.usdoj.gov/criminal/cybercrime/1030_new.html

Title of the page is "18 USC 1030, as amended Oct 11, 1996".  And the language you
cite from 18 USC 1030 (5)(A)(i) was in there back then.  In 1996. Plenty of time to
build up case law.

Interesting that no spammer seems to have actually brought suit under 18 USC 1030 (g):

http://www4.law.cornell.edu/uscode/18/1030.html

"Any person who suffers damage or loss by reason of a violation of this section
may maintain a civil action against the violator to obtain compensatory damages
and injunctive relief or other equitable relief. A civil action for a violation
of this section may be brought only if the conduct involves 1 of the factors
set forth in clause (i), (ii), (iii), (iv), or (v) of subsection (a)(5)(B).
Damages for a violation involving only conduct described in subsection
(a)(5)(B)(i) are limited to economic damages. No action may be brought under
this subsection unless such action is begun within 2 years of the date of the
act complained of or the date of the discovery of the damage. No action may be
brought under this subsection for the negligent design or manufacture of
computer hardware, computer software, or firmware.

I'm sure if that legal theory were sustainable, MAPS would have been served notice
of a lawsuit by now....  And I know there's people from MAPS lurking here, so
if they want to chime up that such a lawsuit has made it past the preliminary
stages (i.e. didn't get thrown out by a judge immediately), they can...

---

From: Richard Welty <[email-masked]>
Date: Sat, 10 Jan 2004 14:54:20 -0500 (EST)

> Non sequitor. By your implied logic, no new laws could be
> effectively created or enforced, since all would lack precedent.
> The relevant code is relatively new, so only limited, if any,
> case law can be expected to be extant in any case.

so, you have a statute dated 1996 which you claim prohibits
certain activities. you are apparently unable to cite any case
law (i don't know if you actually have tried to find any or not,
you simply responded by dismissing the suggestion.)

i suspect you're not a lawyer. i also seriously doubt you've
actually asked a lawyer specializing in this type of law for
an informed opinion.

i think that i don't care to take "legal advice" from you.

have a nice day,
   richard

---

From: [email-masked] (Mike S)
Date: Sat, 10 Jan 2004 14:52:51 -0500

At 01:55 PM 1/10/2004, [email-masked] wrote...
>of a lawsuit by now....

So, your argument amounts to the equivalent of "If life is possible on Mars, then life must exist on Mars." You'd better let NASA know, it may save them a bundle of money.

---

From: "Daniel Pelstring" <[email-masked]>
Date: Sat, 10 Jan 2004 18:07:16 -0500

The law you cited refers only to civil damages resulting from
criminal activity.  In order to press a civil suit under this law, the
defendant would first need to be convicted of criminal activity falling
under (i), (ii), (iii), (iv), or (v) of subsection (a)(5)(B), which in turn
requires a violation of (a)(5)(A) which requires unauthorized access to a
protected computer. 

	The administrator doing the blocking would be in the clear, since
they are authorized to access this computer (and are in fact authorized to
change this information, even if you disagree with the change.)  The
provider of a blocking list would not have accessed this computer at all,
since they did not make the change.  The desires of the intended recipient
do not matter at all under this law, as they do not own the computer on
which the change was made.

	If something has been done which violates a service agreement, you
can press a civil suit based on that agreement, which falls under contract
law and has nothing at all to do with 18 U.S.C. 1030.

	I am not a lawyer, although I did spend much time doing legal
research for one.  This is actually an extremely simple law, and I can say
with a fair degree of certainty that it does not cover what you think it
does.

	If you need legal advice, talk to a lawyer, you may have a civil
suit if this filtering violates a contract you have with the party in
question.  18 U.S.C. 1030 however, does not apply here.

I hope this was helpful.

-Daniel Pelstring

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Mike S
Sent: Saturday, January 10, 2004 11:45 AM
To: [email-masked]
Subject: Re: SMTP Minimum Retry Period - Proposal To Modify Mx 

>Not in any mail I've seen so far, but the other traffic since implies I've
missed something.  Investigating that... my apologies.

18 U.S.C. 1030

>In any case, the quotations I've seen suggest you believe that the blocking
is done without authorization. 

That is correct. Understand that I am NOT referring to UCE/spam. In the case
of UCE/Spam, I will stipulate that the intended recipient may indeed have
authorized upstream blocking/filtering. It is, however, irrational and
incorrect to argue that the recipient has authorized blocking/filtering of
email replies sent in direct response to queries they have sent. RBL/DUL
makes no distinction between these types of email, and indiscriminately
causes both types to be blocked. One cannot argue that general "best effort"
or "no guarantees" terms of service cover this situation, since the blocking
is known and deliberate.

> As I said in my previous mail, I suspect the service agreement is likely
to provide for it;

I can only speak for the ISP agreements I've been a party to, and they do
NOT authorize any upstream filtering or blocking.

>And I suspect the receiving computer to which "damage" would be done would
be the ISP's mail server; presumably none of this is interfering with the
transmission between the ISP's mail server and the customer's machine.

It is interfering with communications between sender and recipient, which is
exactly what the cited law prohibits. The maintainer of the MX has publicly
agreed to accept mail destined for the domain (by publishing an MX record).
Blocking/refusing/filtering email bound for a protected system is a
violation of U.S. law, unless specific authorization has been granted to do
so, which has not occurred (see above).

---

From: [email-masked] (Mike S)
Date: Sat, 10 Jan 2004 19:18:56 -0500

At 06:07 PM 1/10/2004, Daniel Pelstring wrote...
>change this information, even if you disagree with the change.)

The law prohibits "intentionally cause[ing] damage without authorization, to a protected computer." The MX is not the "protected computer" in the discussion at hand. The "protected computer" is the computer of the email addressee. The MX is merely an intermediary.

By the logic you present, one could argue that no violation (of this law) would be present for hacking a backbone router and inserting a filter which dropped all incoming packets bound for any next hop, since that router would not be "damaged" under the definition given by 18 U.S.C. 1030, the "damage" only occurring external to that router. 

>  The

The change interferes with the delivery of email to a "protected computer," i.e. the computer of the person to whom the email is sent. The ISP's mail exchanger is simply an intermediary. 

The RBL and DUL are quite clearly (and openly) designed and intended to be used to implement denial of service. Doing so with the explicit authorization of the email recipient would be legal. 

Using MAPS RBL and/or DUL is an act which "knowingly causes the transmission of a program, information, code, or command, and as a result of such conduct, intentionally causes damage ['impairment to the integrity or availability of data, a program, a system, or information'] without authorization, to a protected computer," a violation of 18 U.S.C. 1030. The "protected system" is the email addressee's, not the ISP's. If a recipient is not receiving desired email due to ISP use of the MAPS system, the ISP is guilty of unlawful denial of service. Not only the ISP, but also MAPS, is guilty of knowingly and intentionally damaging a protected computer.

A person may authorize, indeed ask, that spam be blocked upstream. With such authorization, an ISP is clearly free to block spam email. As I have already pointed out, it is irrational to claim that a addressee has authorized that _desired_ email be dropped. I have encountered exactly that situation due to use of the MAPS DUL. 

The MAPS system does not, and cannot, distinguish between spam email and legitimate, addressee desired email. It is a brute force system which throws the baby out with the bathwater.

---

From: [email-masked] (Mike S)
Date: Sat, 10 Jan 2004 19:42:18 -0500

The recent thread which I've been contributing to has extended too far from both the original subject and the purpose of this list. I will make no further responses via this list. Those interested and willing to argue their points of view are free to use direct email, which is what I will do should I respond further.

---

From: grenville armitage <[email-masked]>
Date: Sun, 11 Jan 2004 11:58:28 +1100

Mike S wrote:
	[..]
> The change interferes with the delivery of email to a "protected
> computer," i.e. the computer of the person to whom the email is sent.
> The ISP's mail exchanger is simply an intermediary.

You have no right, without a contract, to *demand* transit service from
any ISP's mail exchanger. If you *have* a contract then read the fineprint carefully.
You probably delegated to your ISP the right to accept/reject SMTP connections carrying
emails nominally heading to your address/mailbox.

	[..]
> The MAPS system does not, and cannot, distinguish between spam email
> and legitimate, addressee desired email.

True, but irrelevant to the question of who is authorized to protect what machines.

cheers,
gja

---

From: Vernon Schryver <[email-masked]>
Date: Sat, 10 Jan 2004 18:07:21 -0700 (MST)

> From: [email-masked] (Mike S)

> ...
> The RBL and DUL are quite clearly (and openly) designed and
> intended to be used to implement denial of service. Doing so with
> the explicit authorization of the email recipient would be legal.

> ...
> The MAPS system does not, and cannot, distinguish between spam
> email and legitimate, addressee desired email. It is a brute force
> system which throws the baby out with the bathwater.

Who but someone incapable of understanding the concept of one person
never wanting to receive any mail or other communications from another
could say something like that?  For the rest of us, it makes perfect
sense to say "I never want to receive any mail from any IP address
owned by Stanford Wallace.  I also never want to receive mail from any
SMTP client using an IP address that has been declared 'dynamic' by
its owner, because that declaration says that its owner cannot figure
out who is using the address at any given time."

I suspect that Mike Sauve (msauve at alientech.net) is upset with the
RBL and DUL because some of his mail was rejected.  I cannot find any
evidence that he has sent unsolicited bulk commecial email, although
some of his public statements about the definition of "spam" have been
a little unusual.  Perhaps he tried to run a commercial site on
"residential" IP addresses and blames MAPS instead of the ISP that
labelled those addresses.

Note:
  - The DUL was largely populated with declarations by the owners of
   the IP addresses in question.

  - The IP address owners are ISPs, not the end users renting them,
   at least if they're not SWIPed.

  - I've always considered "dynamic" declarations by ISPs as implying
   that the ISP is a slumlord uninterested in tracking abuse by its
   users.  Contrary to years of knowingly false statements from such
   as UUNET, anyone with standing to contribute to this list knows
   that figuring out which modem, DSL port, or cable modem port was
   using a block of "dynamic" IP addresses at any given instant requires
   only the will to maintain and consult RADIUS or other logs.

---

From: Keith Moore <[email-masked]>
Date: Sun, 11 Jan 2004 11:59:08 -0500

> that was rejected as the result of RBL listings.

Maybe you ought to get out more.

> listing?

Yes, but I'm not going to dig back through backup tapes looking from 
complaints from users who didn't get their na-digests just because 
you're in denial.

> rejected by other peoples SMTP servers?

Sites can reject mail to their own servers if they want to.  the issue 
is whether they're being misled about the criteria used by a blacklist.

>  I think that as long as

Apparently you also think that it's acceptable to forward mail from 
people you don't like to DCC, misrepresenting it as spam.  The only 
reasonable response to people with this kind of attitude ends with "and 
the horse you rode in on".  Actually, that's being far too polite.

---

From: Vernon Schryver <[email-masked]>
Date: Sun, 11 Jan 2004 10:48:01 -0700 (MST)

> is whether they're being misled about the criteria used by a blacklist.

If that is an issue, it ought to be raised by those who are being
misled, the targets of mail, instead of senders and other third parties.

> the horse you rode in on".  Actually, that's being far too polite.

First, contrary to Keith Moore's the baloney, DCC clients detect bulk
mail.  It is impossible to (mis)represent mail as unsolicited bulk
mail or spam by forwarding it to a DCC server.  Doing so only reports
it as "bulk."  Are the "courtesy" copies mailing list contributions
that Keith Moore insists on sending "bulk"?  If they are private, then
forwarding them to the DCC instead of my mailbox can have no effect
because no one else will see them.  If they are bulk, then some extra
reporting also has no effect; if DCC clients haven't marked them solicited
bulk by whitelisting the IETF list, they should be rejected as unsolicited
bulk mail.  That's how the DCC works.  So why is Keith Moore so exercised?

Consider "courtesy" copies of mailing list messages and the people who
send them.  Many courtesy copies are sent unthinkingly by using a
"reply all" function, but others are intentional.  The intentional
copies amount to "microphone queue jumping."  Their senders they feel
their targets should see and respond to their words first.  When the
IETF reflector took literally days to finish sending copies to people
at the end of alphabet like me, there might have been other reasons,
but today it finishes within several dozen minutes.

I didn't realize that "courtesy" copies are often intentional queue
jumping until I noticed that senders of "courtesy copies" tend to foam
at the mouth about the evils of MAPS, the RBL, blacklists, and spam
filtering in general.  I did not notice that common thread until I
tired of "courtesy" copies of foaming flaming nonsense and started
dropping senders into my personal, non-published blacklist.

If you want to see apoplectic fits, use a sendmail access_DB instead
of procmail to for your filtering.  That will spare your system a few
cycles, but it also lets senders know they're not being heard.  People
who hate the RBL and DUL for impersonally filtering their earthshaking
words really hate being being personally shunned.

---

From: Keith Moore <[email-masked]>
Date: Sun, 11 Jan 2004 14:24:49 -0500

> misled, the targets of mail, instead of senders and other third 

it IS being raised by them, for those who are actually able to figure 
out what's going on.  of course, when the recipient doesn't receive the 
mail he's expecting, he has no idea where to look - so he tends to 
blame the sender.

> mail.

whatever.  your mail server claims it's forwarding my mail to DCC, and 
it's not bulk mail.

> copies amount to "microphone queue jumping."

"and the horse you rode in on."

you are misleading people, and you know it.

---

From: Vernon Schryver <[email-masked]>
Date: Sun, 11 Jan 2004 13:31:09 -0700 (MST)

> Cc: Keith Moore <[email-masked]>, [email-masked]
> To: Vernon Schryver <[email-masked]>

> mail he's expecting, he has no idea where to look - so he tends to 

Keith Moore is not complaining about mail he has not received because
of the dasterdly misinformation from the RBL.  He is either a third
party sender of reject mail that he is certain was wanted by its targets
despite being rejected or he is a fourth party presuming to speak for
the first parties (spam targets) against the second parties (blacklist
providers).

An odd thing about users of DNS blacklists and other filters is that
many users avoid confronting senders of rejected mail.  Many users are
happy to let senders assume what the senders want to believe, that the
evil nasty rbl consipracy used lies, bribery, and extortion to force
an ISPs to use a blacklist.  Never mind that after being informed of
that evil nexus by senders, most users do nothing but demand even more
filtering.  Ignore the fact that blacklists are free or cost money and
are now generally selling points.

Of course popularity in the market is not proof of virtue, but it does
poke holes in the claims of senders of rejected mail about blacklists.

> whatever.  your mail server claims it's forwarding my mail to DCC, and 

The first phrase is true but only of mail sent directly from Keith
Moore to my SMTP server.  His second statement is false.  Bulk mail
includes any message which has a "a bunch" of copies sent to one or
more mailboxes.  All mail sent through non-trivial mailing list
reflectors is bulk.  Spam is bulk mail that is unsolicited.  "A bunch"
varies depending on whom you ask and when.

Keith Moore has long known that his "courtesy copies" to my mailbox
are unsolicited and unwelcome.  They are identical except in headers
to hundreds of copies of the same messages, and so are "bulk."  I
tolerate (and sometimes find interesting) the copies of his messages
that arrive through the IETF reflector, but I object to duplicate
copies of flames and insults.  If your "a bunch" threshold for "bulk"
is 2, then Keith Moore's attempts to put 2 copies of his messages in
my mailbox are "spam" regardless of the hundreds of copies sent
elsewhere.  (Some people say 2 is the right threshold for "bulk", but
I run my DCC client with a threshold of 5.  5 is a common choice for
vanity domains.  Choices for real domains range from 20 to 200 as well
as the overflow value of "many.")

> you are misleading people, and you know it. 

Notice that he does not specify whom is being misled or the falsehood.

Sheesh!--what would a reasonable person do who knows that one of his
targets doesn't want his "courtesy" copies?

---

From: Keith Moore <[email-masked]>
Date: Sun, 11 Jan 2004 18:03:59 -0500

> the first parties (spam targets) against the second parties (blacklist

You are a barefaced liar.

---

From: Vernon Schryver <[email-masked]>
Date: Sun, 11 Jan 2004 16:59:53 -0700 (MST)

> You are a barefaced liar.

How so in that assertion of mine?  Unless I missed something that seems
unlikely, Keith Moore is not complaining about mail he has failed to
receive.  He surely would not have been misled by blacklist operators
into configuring his SMTP servers to use one of their evil nasty
cheating lying dishonest fraudulent unhealthy fattening cancer-causing
end-to-end principle breaking RBLs.  The remaining possibilities are
that he writing is on behalf of himself as a sender of rejected mail
or he is a fourth party presuming to speak for the people actually
involved, senders, receivers, and blacklist operators.

I admit that I would not be surprised if his opinion of anti-spam
blacklists was informed long ago when some of his more or less innocent
mail was rejected with a reference to MAPS's RBL.  I've no evidence
of that except his use of archaic jargon and what his "courtesy copies"
and statements about how I've configured my SMTP server show of his
views of those who would be happier with fewer of his words.

Concerning how I've configured my SMTP server--Juging from the headers
of the IETF list messages, today it has rejected 2 copies of "and the
horse you rode in on" and one copy of "You are a barefaced liar."  That
seems like a Good Thing(tm), but perhaps not enough.

---

From: Keith Moore <[email-masked]>
Date: Sun, 11 Jan 2004 19:48:59 -0500

> How so in that assertion of mine?

Folks who can't see the hole in your analysis for themselves can ask me 
in private mail.  Somehow I doubt the IETF list cares enough to want to 
keep reading this exchange, and you've already demonstrated that you 
don't care what I say.

---

From: [email-masked] (Mike S)
Date: Fri, 09 Jan 2004 22:09:22 -0500

At 06:41 PM 1/9/2004, Vernon Schryver wrote...

>listing?  Note that the validity of mail is determined not its senders

Yes. For a lengthy period, all mail.com SMTP servers were included in the RBL, blocking significant numbers of legitimate, private, non-spam emails from reaching willing recipients.